mkosi: Enable more options

We build with support for selinux/apparmor where applicable but
disable them at runtime as even in permissive mode they're horribly
broken.

diff --git a/mkosi.conf.d/10-systemd.conf b/mkosi.conf.d/10-systemd.conf
index 78b438b5db96ad69d0ae1507e8c87371c72391f9..7cc3e8c4eb15f5241974aee5960deacde7ea3dc2 100644 (file)
--- a/mkosi.conf.d/10-systemd.conf
+++ b/mkosi.conf.d/10-systemd.conf
@@ -39,3 +39,7 @@ KernelCommandLineExtra=systemd.crash_shell
                        # Lower the default device timeout so we get a shell earlier if the root device does
                        # not appear for some reason.
                        systemd.default_device_timeout_sec=10
+                       # Make sure no LSMs are enabled by default.
+                       apparmor=0
+                       selinux=0
+                       enforcing=0

diff --git a/mkosi.presets/00-base/mkosi.build b/mkosi.presets/00-base/mkosi.build
index eb18d27577dc86e3fd112bb8d6d597143de79efa..d31eb338c63322b43cb6db3c62a5e85a7e6c8d52 100755 (executable)
--- a/mkosi.presets/00-base/mkosi.build
+++ b/mkosi.presets/00-base/mkosi.build
@@ -134,6 +134,14 @@ if [ ! -f "$BUILDDIR"/build.ninja ]; then
         -D analyze=true
         -D bpf-framework=true
         -D ukify=true
+        -D seccomp=true
+        -D selinux=auto
+        -D apparmor=auto
+        -D smack=true
+        -D ima=true
+        -D first-boot-full-preset=true
+        -D initrd=true
+        -D fexecve=true
     )
 
     # On debian-like systems the library directory is not /usr/lib64 but /usr/lib/<arch-triplet>/.

diff --git a/mkosi.presets/00-base/mkosi.conf.d/10-debian-ubuntu.conf b/mkosi.presets/00-base/mkosi.conf.d/10-debian-ubuntu.conf
index 920e50e42b9d82d3c57202443262e3c949bc0c49..1c4cb2d7acca7c2373d423dfceb20e903d2562f6 100644 (file)
--- a/mkosi.presets/00-base/mkosi.conf.d/10-debian-ubuntu.conf
+++ b/mkosi.presets/00-base/mkosi.conf.d/10-debian-ubuntu.conf
@@ -6,6 +6,7 @@ Distribution=debian ubuntu
 [Content]
 Packages=
         dmsetup
+        libapparmor1
         libfdisk1
         libfido2-1
         libglib2.0-0
@@ -28,6 +29,7 @@ BuildPackages=
         dpkg-dev
         g++
         libacl1-dev
+        libapparmor-dev
         libaudit-dev
         libblkid-dev
         libbpf-dev